CVE-2022-1091: 10up safe_svg Cross-site Scripting
Vulnerability summary
CVE-2022-1091 is a high (CVSS 7.7) Cross-site Scripting vulnerability in 10up safe_svg. EPSS estimates a 1.20% chance of exploitation in the next 30 days, higher than 67.9% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 18-04-2022PublishedVulnerability first disclosed.
- 02-08-2024Last modifiedVulnerability information updated.
Description
The sanitisation step of the Safe SVG WordPress plugin before 1.9.10 can be bypassed by spoofing the content-type in the POST request to upload a file. Exploiting this vulnerability, an attacker will be able to perform the kinds of attacks that this plugin should prevent (mainly XSS, but depending on further use of uploaded SVG files potentially other XML attacks).
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NDiffers
EPSS trend
Probability
1.20%
Chance of exploitation in the next 30 days
Percentile
68%
Versus all other CVEs
30-day change
0.00 pp
From 1.20% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (wpscan.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
10up1 product
- safe_svg< 1.9.10
Unknown1 product
- safe svg≥ 1.9.10, < 1.9.10
Wordpress1 product
- safe-svg< 1.9.10
3 vendors · 3 products
References
3 links- wpscan.com/vulnerability/4d12533e-bdb7-411f-bcdf-4c5046db13f3X Refsource MISCExploitThird Party Advisory